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Neural cryptography is based on a competition between attractive and repulsive stochastic forces. 
A feedback mechanism is added to neural cryptography which increases the repulsive forces. Using 
numerical simulations and an analytic approach, the probability of a successful attack is calculated 
for different model parameters. Scaling laws are derived which show that feedback improves the 
security of the system. In addition, a network with feedback generates a pseudorandom bit sequence 
which can be used to encrypt and decrypt a secret message. 
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I. INTRODUCTION 

Neural networks learn from examples. When a system 
of interacting neurons adjusts its couplings to a set of ex- 
ternally produced examples, this network is able to esti- 
mate the rule which produced the examples. The proper- 
ties of such networks have successfully been investigated 
using models and methods of statistical physics 

Recently this research program has been extended to 
study the properties of interacting networks 0, H ■ Two 
networks which learn the examples produced by their 
partner are able to synchronize. This means that af- 
ter a training period the two networks achieve identical 
time dependent couplings (synaptic weights). Synchro- 
nization by mutual learning is a phenomenon which has 
been applied to cryptography 0, [|| . 

To send a secret message over a public channel one 
needs a secret key, either for encryption, decryption, or 
both. In 1976, Diffie and Hellmann have shown how 
to generate a secret key over a public channel with- 
out exchanging any secret message before. This method 
is based on the fact that — up to now — no algorithm is 
known which finds the discrete logarithm of large num- 
bers by feasible computer power Q. 

Recently it has been shown how to use synchronization 
of neural networks to generate secret keys over public 
channels |f| . This algorithm, called neural cryptography, 
is not based on number theory but it contains a physi- 
cal mechanism: The competition between stochastic at- 
tractive and repulsive forces. When this competition is 
carefully balanced, two partners A and B are able to syn- 
chronize whereas an attacking network E has only a very 
low probability to find the common state of the commu- 
nicating partners. 

The security of neural cry ptog raphy is still being de- 
bated and investigated [H, 0, H3, lU LL3 • In this paper 
we introduce a mechanism which is based on the gener- 
ation of inputs by feedback. This feedback mechanism 
increases the repulsive forces between the participating 
networks, and the amount of the feedback, the strength 
of this force, is controlled by an additional parameter of 




FIG. 1: A tree parity machine with K = 3 and N = 4. 



our model. 

A measure of the security of the system is the prob- 
ability Pe that an attacking network is successful. We 
calculate Pe obtained from the best known attack Q for 
different model parameters and search for scaling proper- 
ties of the synchronization time as well as for the security 
measure. It turns out that feedback improves the secu- 
rity significantly, but it also increases the effort to find 
the common key. When this effort is kept constant, feed- 
back only yields a small improvement of security. 



II. REPULSIVE AND ATTRACTIVE 
STOCHASTIC FORCES 

The mathematical model used in this paper is called a 
tree parity machine (TPM), sketched in Fig.^ It consists 
of K different hidden units, each of them being a percep- 
tron with an iV-dimensional weight vector When a 
hidden unit k receives an iV-dimensional input vector x^ 
it produces the output bit 



cr fc = sgn(w fc ■ x fc ) . 



(1) 



The K hidden units Uk define a common output bit r of 
the total network by 



K 

fc=i 



(2) 
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In this paper we consider binary input values x k _j £ 
{—1, +1} and discrete weights Wfe j e {— L, — L+l, L— 
1,L}, where the index j denotes the N components and 
k the K hidden units. 

Each of the two communicating partners A and B 
has its own network with an identical TPM architec- 
ture. Each partner selects random initial weight vectors 
w A (t = 0) and w£(t = 0). 

Both of the networks are trained by their mutual out- 
put bits t a and t b . At each training step, the two net- 
works receive common input vectors x k and the corre- 
sponding output bit r of its partner. We use the following 
learning rule. 

(1) If the output bits are different, t a ^ t b , nothing 
is changed. 

(2) If t a = t b = t only the hidden units are trained 
which have an output bit identical to the common 

OUtput, 4 IB = T A ' B . 

(3) To adjust the weights we consider three different 
learning rules. 



(1) an attractive move for a A — <x-( 



r A/B. 



(i) Anti-Hebbian learning 



w+ = w fc - Tx k e(a k T)Q{T A T B ) 



(3) 



(4) 



(ii) Hebbian learning 
W+ = Wfe + Tx k Q(a k T)e{T A T B ) . 

(iii) Random walk 

w+ = w fe + Xfe.e(afeT)e(T A T B ) . (5) 

If any component w k _j moves out of the interval 
—L, . . . , L, it is replaced by sga{wk,j)L. 

Note that for the last rule, the dynamics of each com- 
ponent is identical to a random walk with reflecting 
boundaries. The only difference to usual random walks 
is that the dynamics is controlled by the 2K global sig- 
nals o^ B which, in turn, are determined by the ensem- 
ble of random walks. Two corresponding components of 
the weights of A and B receive an identical input x k j, 
hence they move into the same direction if the control 
signal allows both of them the move. As soon as one 
of the two corresponding components hits the boundary 
their mutual distance decreases. This mechanism finally 
leads to complete synchronization, w A (t) = wj^(t) for all 

t _ t sync- 

On average, a common step leads to an attractive 
force between the corresponding weight vectors. If, how- 
ever, only the weight vector of one of the two partners 
is changed the distance between corresponding vectors 
increases, on average. This may be considered as a re- 
pulsive force between the corresponding hidden units. 

A learning step in at least one of the K hidden units 



occurs if the two output bits are identical, t 1 



In 



this case, there are three possibilities for a given pair of 
hidden units: 



(2) a repulsive move for a A ^ a 



k > 



(3) and no move at all for a A = a B ^ t a I b . 

We want to calculate the probabilities for repulsive and 
attractive steps 0, ^| . The distance between two hidden 
units can be defined by their mutual overlap 



Pk 



(6) 



The probability e k that a common randomly chosen 
input Xfc leads to a different output bit a A ^ a B of the 
hidden unit is given by |2j 



1 

e k = — arccos p k . 

7T 



(7) 



The quantity e k is a measure of the distance between 
the weight vectors of the corresponding hidden units. 
Since different hidden units are independent, the values 
efe determine also the conditional probability P r for a 
repulsive step between two hidden units given identical 
output bits of the two TPMs. In the case of identical 
distances, e k — e, one finds for K = 3 



Pr 



(I-e) 3 + 3(I-e)e 2 



(8) 



On the other side, an attacker E may use the same al- 
gorithm as the two partners A and B. Obviously, it will 
move its weights only if the output bits of the two part- 
ners are identical. In this case, a repulsive step between 
E and A occurs with probability P r = e where now e is 
the distance between the hidden units of E and A. 

Note that for both the partners and the attacker one 
has the important property that the networks remain 
identical after synchronization. When one has achieved 
e = at some time step, the distance remains zero for- 
ever, according to the previous equations for P r . How- 
ever, although the attacker uses the same algorithm as 
the two partners, there is an important difference: E can 
only listen but it cannot influence A or B. This fact leads 
to the difference in the probabilities of repulsive steps; 
the attacker has always more repulsive steps than the 
two partners. For small distances e«l, the probability 
P r increases linear with the distance for the attacker but 
quadratic for the two partners. This difference between 
learning and listening leads to a tiny advantage of the 
partners over an attacker. The subtle competition be- 
tween repulsive and attractive steps makes cryptography 
feasible. 

On the other side, there is always a nonzero probabil- 
ity Pe that an attacker will synchronize, too |Tl|. For 
neural cryptography, Pe should be as small as possible. 
Therefore it is useful to investigate synchronization for 
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different models and to calculate their properties as a 
function of the model parameters. 

Here we investigate a mechanism which decreases Pg, 
namely we include feedback in the neural networks. The 
input vectors x^ are no longer common random numbers, 
but they are produced by the bits of the correspond- 
ing hidden units. Therefore the hidden units of the two 
partners no longer receive an identical input, but two 
corresponding input vectors separate with the number 
of training steps. To allow synchronization, one has to 
reset the two inputs to common values after some time 
interval. 

For nonzero distance e > 0, this feedback mechanism 
creates a sort of noise and increases the number of re- 
pulsive steps. After synchronization e = 0, feedback will 
produce only identical input vectors and the networks 
move with zero distance forever . 

Before we discuss synchronization and several attack- 
ing scenarios, we consider the properties of the bit se- 
quence generated by a TPM with feedback. 



III. BIT GENERATOR 

We consider a single TPM network with K hidden 
units, as in the preceding section. We start with K ran- 
dom input vectors x&. But now, for each hidden unit k 
and for each time step t, the input vector is shifted and 
the output bit <J fe (t) is added to its first component [lt| . 
Simultaneously, the weight vector is trained accord- 
ing to the anti-Hebbian rule, Eq. @. Consequently, the 
bit sequence r(t) generated by the TPM is given by the 
equation 

r(t) = J] sgn [ Wk,j (t)a k (t - j) \ . (9) 
k=i / 

Similar bit generators were introduced in Ref. [l7| and 
the statistical properties of their generated sequences 
were investigated |l8| . Here we study the correspond- 
ing properties for our TPM with discrete weights. 

The TPM network has 2 KN possible input and (2L + 
1) KN weight vectors. Therefore our deterministic finite 
state machine can only generate a periodic bit sequence 
whose length I is limited by (4L + 2) KN . 

Our numerical simulations show that the average 
length (/) of the period indeed increases exponentially 
fast with the size KN of the network, but it is much 
smaller than the upper bound. For K — 3 and L > N 
we find (I) oc (2.69) 3JV , independent of the number L of 
weight values. 

The network takes some time before it generates the 
periodic part of the sequence. We find that this transient 
time also scales exponentially with the system size KN. 
This means that, for sufficiently large values of N, say 
N > 100, any simulation of the bit sequence remains in 
the transient part and will never enter the cycle. 
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FIG. 2: Probability P 3y „c as a function of the fraction a w 
of initially known weights, calculated from 1000 simulations 
with K = 3 and N = 100. 
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FIG. 3: The average overlap between student and generator 
as a function of the number of steps for K = 3, L = 5, and 
N = 100. 



The bit sequence generated by a TPM with K > 2 
cannot be distinguished from a random bit sequence. For 
K = L = 3 we have numerically calculated its entropy 
and found the value In 2 as expected from a truly random 
bit sequence. In addition, we have performed several 
tests on randomness as described by Knuth . We did 
not find any correlations between consecutive bits; the 
bit sequence passed all tests on randomness within strict 
confidence levels. 

Although the bit sequence passed many known tests on 
random numbers we know that it is generated by a neural 
network. Does this knowledge help to estimate correla- 
tions of the sequence and to predict it? In fact, for a 
sequence generated by a perceptron (TPM with K = 1), 
another perceptron trained on the sequence could achieve 
an overlap to the generator 0. 

Consider a bit sequence generated by a TPM with 
the anti-Hebbian rule. Another TPM (the "student" ) is 
trained on this sequence using the same rule. In addition, 
if the output bit disagrees with the corresponding bit of 
the sequence, we use the geometric method of Ref. Q to 
perform a training step. 
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Figures and [3] show that for K = 3 hidden units, 
it is not possible to obtain an overlap to the generating 
TPM by learning the sequence. Only if the initial over- 
lap between the generator and the student is very large 
there is a nonzero probability P syn c that the student will 
synchronize with the generator. If it does not synchro- 
nize, the overlap between student and generator decays 
to zero. 

Summarizing, a TPM network generates a pseudoran- 
dom bit sequences which cannot be predicted from part 
of the sequence. As a consequence, for cryptographic ap- 
plications, the TPM can be used to encrypt and decrypt 
a secret message after it has generated a secret key. 



IV. SYNCHRONIZATION 

As shown in the preceding section, a TPM cannot learn 
the bit sequence generated by another TPM since the 
two input vectors are completely separated by the feed- 
back mechanism. This also holds for synchronization 
by mutual learning: With feedback, two networks can- 
not be attracted to an identical time dependent state. 
Hence, to achieve synchronization, we have to introduce 
an additional mechanism which occasionally resets the 
two inputs to a common vector. This reset occurs when- 
ever the system has produced R different output bits, 
T A (t) ^ T B (t). For R — we obtain synchronization 
without feedback, which has been studied previously, and 
for large values of R the system does not synchronize. 
Accordingly, we have added a new parameter in our al- 
gorithm which increases the synchronization time as well 
as the difficulty to attack the system. In the following 
two sections, we investigate synchronization and security 
of the TPM with feedback quantitatively. 

We consider two TPMs A and B which start with dif- 
ferent random weights and common random inputs. The 
feedback mechanism is defined as follows. 

(i) After each step t the input is shifted, Xkj(t + 1) = 
x k ,j-i(t) for j > 1. 

(ii) If the output bits agree, r A (t) = r B (t), the out- 
put of each hidden unit is used as a new input bit, 
%k,i(t + 1) = (Jk{t), otherwise all K pairs of in- 
put bits Xk,i{t) are set to common public random 
values. 

(hi) After R steps with different output, r A (t) ^ r B (t), 
all input vectors are reset to public common ran- 



dom vectors, x A j(t + 1) = x B j(t + I) 



Feedback creates correlations between the weights and 
the inputs. Therefore the system becomes sensitive to 
the learning rule. We find that only for the anti-Hebbian 
rule, Eq. ©, the components of the weights have a broad 
distribution. The entropy per component is larger than 
99% of the maximal value ln(2L + 1). For the Hebbian or 
random walk rule, the entropy is much smaller, because 
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FIG. 4: Average synchronization time t sync and its standard 
deviation as a function of L, found from 10 000 simulation 
runs with K = 3 and N = 10000. The line 52L 2 is a result of 
linear regression for R — 0. 
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FIG. 5: The synchronization time t sync and its standard 
deviation as a function of L, averaged over 10 000 runs of the 
iterative equations for K = 3. 



the values of the weights are pushed to the boundary 
values ±L. Therefore the network with the anti-Hebbian 
rule offers less information to an attack than the two 
other rules. 

In Fig. 0] we have numerically calculated the average 
synchronization time as a function of the number L of 
components for the anti-Hebbian rule. Obviously, there 
is a large deviation from the scaling law t sync oc I? as 
observed for R — 0. Our simulations for larger values 
of N, which are not included here, show that there exist 
strong finite size effects which do not allow to derive a 
reliable scaling law from the numerical data. 

Fortunately, the limit N — > oo can be performed ana- 
lytically. The simulation of the KN weights is replaced 
by a simulation of an (2L + 1) x (2L + 1) overlap matrix 
f£ b for each hidden unit k which measures the fraction 
of weights which are in state a for the TPM A and in 
state b for B [HH^. 

We have extended this theory to the case of feedback. 
A new variable Afc (t) is introduced which is defined as the 
fraction of input components j which are different be- 
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FIG. 6: The success probability Pe as a function of L, aver- 
aged over 10 000 simulations with K — 3 and N = 1000. 



FIG. 8: The success probability Pe as a function of L, found 
from 10 000 runs of the iterative equations for K — 3. 
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FIG. 7: The coefficient u as a function of the feedback pa- 
rameter R, calculated from the results shown in Fig. [5] 



FIG. 9: The coefficient y as a function of the feedback pa- 
rameter R, calculated from the results shown in Fig. [8] 



tween the corresponding hidden units of A and B. This 
variable changes with time, and it influences the equa- 
tion of motion for the overlap matrix f^ b {t). Details are 
described in the Appendix. 

Figure [S] shows the results of this semianalytic theory. 
Now, in the limit of N — > oo, the average synchronization 
time can be fitted to increase with a power of L, roughly 
proportional to L 2 . The data indicate that only the pref- 
actor but not the exponent depends on the strength R 
of the feedback; the prefactor seems to increase linearly 
with R. 

Hence, if the network is large enough, feedback has 
only a small effect on synchronization. In the following 
section we investigate the effect of feedback on the se- 
curity of the network: How does the probability that an 
attacker is successful depend on the feedback parameter 
Rl 



V. ENSEMBLE OF ATTACKERS 

Up to now, the most successful attack on neural cryp- 
tography is the geometric attack 0, ^J. The attacker 
E uses the same TPM with an identical training step as 



the two partners. That means, only for t 1 



the 



attacker performs a training step. When its output bit 
t e agrees with the two partners, the attacker trains the 
hidden units which agree with the common output. For 
t e ^ t a I b , however, the attacker first inverts the out- 
put bit crfc for the hidden unit with the smallest absolute 
value of the internal field and then performs the usual 
training step. 

For the geometric attack the probability Pe that an 
attacker synchronizes with A and B is nonzero. Conse- 
quently, if the attacker uses an ensemble of sufficiently 
many networks there is a good chance that at least one 
of them will find the secret key. 

We have simulated an ensemble of attackers using the 
geometric attack for the two TPMs with feedback and 
anti-Hcbbian learning rule. Of course, each attacking 
network uses the same feedback algorithm as the two 
partner networks. Figure shows the results of our 
numerical simulations. The success probability Pe de- 
creases with the feedback parameter R. For the model 
parameters shown in Fig.[S]we find that Pe can be fitted 
to an exponential decrease with L 2 , 
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FIG. 10: The success probability Pe as a function of the av- 
erage synchronization time t sync , calculated from the results 
shown in Figs. and [S] 



The coefficient u increases linearly with R, as shown 
in Fig.[7| The scaling [Eq. l|l(J[l ]. however, is a finite size 
effect. For large system sizes A, the success probability 
decreases exponentially with L instead of L 2 , 



P E oc e- yL . 



(11) 



This can be seen from the limit N — > oo which can be 
performed with the analytic approach of the preceding 
section. Now the dynamics of the system is described by 
a tensor /™ b e for the three networks A, B, and E and 
corresponding variables A^, Af , Af\ Details are given in 
the Appendix. 

Figure 00 indicates the exponential scaling behavior 
[Eq. (|1 If) ] for several values of R. The coefficient y in- 
creases linearly with R, as shown in Fig. [!|] 

These results show that feedback improves the security 
of neural cryptography. The synchronization time, on the 
other side, increases, too. Does the security of the system 
improve for constant effort of the two partners? 

This question is answered in Fig. I1UI which shows the 
probability Pe as a function of the average synchroniza- 
tion time, again for several values of the feedback pa- 
rameter R. On the logarithmic scale shown for Pe, the 
security does not depend much on the feedback. For con- 
stant effort to find the secret key, feedback yields a small 
improvement of security, only. 



VI. CONCLUSIONS 

Neural cryptography is based on a delicate competi- 
tion between repulsive and attractive stochastic forces. A 
feedback mechanism has been introduced which amplifies 
the repulsive part of these forces. We find that feedback 
increases the synchronization time of two networks and 
decreases the probability of a successful attack. 

The numerical simulations up to N — 10 5 do not allow 
to derive reliable scaling laws, neither for the synchro- 
nization time nor for the success probability. But the 



limit A — > oo which can be performed analytically indi- 
cates that the scaling laws with respect to the number 
L of component values are not changed by the feedback, 
only the respective coefficients are modified. The average 
synchronization time increases with L 2 while the prob- 
ability Pe of a successful attack decreases exponentially 
with L, for huge system sizes N. 

Accordingly, the security of neural cryptography is im- 
proved by including feedback in the training algorithm. 
But simultaneously the effort to find the common key 
rises. We find that for a fixed synchronization time, feed- 
back yields a small improvement of security, only. 

After synchronization, the system is generating a pseu- 
dorandom bit sequence which passed all tests on ran- 
dom numbers applied so far. Even if another network is 
trained on this bit sequence it is not able to extract some 
information on the statistical properties of the sequence. 
Consequently, the neural cryptography cannot only gen- 
erate a secret key, but the same system can be used to 
encrypt and decrypt a secret message, as well. 



APPENDIX: SEMIANALYTICAL CALCULATION 
FOR SYNCHRONIZATION WITH FEEDBACK 

In this appendix we describe our extension of the semi- 
analytic calculation yjj |2fJ to the case of feedback. 

The effect of the feedback mechanism depends on the 
fraction A of newly generated input elements Xk,j per step 
and hidden unit. In the numerical simulations presented 
in this paper A is equal to A -1 . In this case the effect of 
the feedback mechanism vanishes in the limit A — > oo. 
But it is also possible to generate several input elements 
%k,j per hidden unit and step. For that purpose one can 
multiply the output bit 07. with AA random numbers 
z £ {— 1,+1}. As we want to compare the results of the 
semianalytical approach with simulations for A = 1000, 
we set A = 10~ 3 in the following calculations. 

In the case of two TPMs the development of the input 
noise Afc is given by 



(1 - A) A fc + A Q(-oM) ®(t a t") . (A.l) 



At the beginning and after R steps with t a ^ t b all 
variables Afc are set to zero (according to the algorithm 
described in Sec. UVfl . 

The input noise generated by the feedback mechanism 
affects the output of the hidden units. An input element 



with xj^j 



causes the same output aj: as a change 



of sign in ■ together with equal inputs for both A and 
B. Therefore the probability ek, e s that two hidden units 
with overlap pfc and input error Afc disagree on the output 
bit is given by 

efc.cff = - arccos(l - 2Afc)pfc . (A. 2) 

The distance efc e ff between the hidden units of A and 
B is used to choose the output bits at a nd aj? with the 
correct probabilities in each step |13l |20| . 
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The feedback mechanism influences the equation of 
motion for the overlap matrix /* 6 , too. Here we use 
additional variables A™ = Q(ajI l T m )0{T A T B ) to deter- 
mine if the weights of hidden unit k in the TPM of 
to G {A, B, E} change (A™ = 1) or not (A™ = 0). 
Therefore we are able to describe the update of elements 
fab awa y from the boundary (-L < a, b < L) in only 
one equation: 



f 



k+ 



1 - A fc fc 

2 Ua+A£,6+Ai 



f a -Af,b-Al 



+ 2 Xk ^+ A k- b - A k + ^~ A i> b + A k )■ ( A -3) 



The second term in Eq. I|A.3(I which is proportional 
to Ak shows the repulsive effect of the feedback mecha- 
nism. Similar equations can be derived for elements on 
the boundary. 

In the limit N — > oo the number of steps required to 
achieve full synchronization diverges [9J . Because of that 
one has to define a criterion which determines synchro- 
nization in order to analyze the scaling of t sync using 
semianalytic calculations. As in Ref. Qj| we choose the 
synchronization criterion p AB — | Ylk-i Pk B — ^-9. 

In order to analyze the geometric attack in the limit 
N — > oo one needs to extend the semianalytical calcula- 
tion to three TPMs. In this case the development of the 
input noise is given by the following equations: 



A t 



= AQ(-<r A a B )e(-a A aZ)Q(T A T B ) 

+ (l-A)A^, (A.4) 

= KQ{-a B a A )Q{-a B a E )Q{r A r B ) 

+ (l-A)Af, (A.5) 

= KQ{-a E a A )@{-a E a B )@{r A T B ) 

+ (l-A)Af. (A.6) 



3 the distance e™" ff between two 



Analogical to Eq 
hidden units can be calculated from the overlap pT} 71 and 
the variables AT and A?,: 



e £2f = -arocos(l-2Aj?-2A2)^ 

7T 



(A.7) 



But for the geometric attack the attacker E needs to 
know the local fields h E . The joint probability distribu- 
tion of h A , h B and h E is given by 



P(h A ,h B ,h E ) = 



v/(2^) 3 detC fc 



(A. 



The covariance matrix in this equation describes the cor- 
relations between the three neural networks: 



r)A tdAB r>AE 



C k = 



Q? R BE 



r>AB 

nAE nBE 
n k,cS n k,eS 



:,cff "fc.eff 



k,cS 



(A.9) 



From the tensor /™ b and the variables A™ one can easily 
calculate the elements of Ck- 



Qi 



^ a ^fa,b t e » 
a.b.e— — L 

a,b.e— — L 
L 

V P 2 f k 

/ j ° J a,b,e ) 



(A.10) 
(A.ll) 
(A.12) 



t>AB 
n k,c« 



(l-2Aj*-2Af) £ oV* 6ie ,(A.13) 

a,b,e= — L 
L 

R AE S = (l-2A£-2Af) J] «< 6 ,e,(A.14) 

a,6,e= — L 
L 

i^f ff = (l-2Af -2Af) £ &e/ a fc Ae .(A.15) 

a,6,e— — L 

We use a pseudorandom number generator to deter- 
mine the values of h A , h B , and h E in each step. The 
application of the rejection method |2l| ensures that the 
local fields have the right joint probability distribution 
P(h A ,h B ,h E ). Then the output bits of the_ hidden 



units are given by a™ — sgn(hT)- If t* 



the hidden unit k with the smallest absolute local field 
| h E | is searched and its output a E is inverted (geomet- 
ric attack). Afterwards the usual training of the neural 
networks takes place. 

The equation of motion for tensor elements /* b away 
from the boundary {—L < a, 6, e < L) is given by 



fk+ _ 
•> a.b,e 



1 \ A \ B \ E 

fk+ _ 1 A k A k A k rk 

2 JcH 

i \A \B \E 

1 ~ A k ~ k ~ fc f k 

9 ■'a- 



Af ,6-Af ,e-A£ 



+ A k fa-A^b+A^e+Al 

+ o A k fa+A£,b-AB,e-A* 
-\ B f k 



-I- 1a b f fe 



_L ±\E fk 

2 fe ■'o-Aj*,6-AjB ,e+Aj; 



(A.16) 



Similar equations can be derived for elements on the 
boundary. An attacker is considered successful if one of 
the conditions p AE > 0.9 or p BE > 0.9 is achieved earlier 
than the synchronization criterion p AB > 0.9. 
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